CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...

EUVD-2024-32418

Malicious code in bioql PyPI...

EUVD-2021-7511

Malicious code in bioql PyPI...

EUVD-2023-45735

Malicious code in bioql PyPI...

EUVD-2022-25034

Malicious code in bioql PyPI...

EUVD-2025-17126

Malicious code in bioql PyPI...

EUVD-2024-33407

Malicious code in bioql PyPI...

EUVD-2023-56343

Malicious code in bioql PyPI...

EUVD-2024-34232

Malicious code in bioql PyPI...

EUVD-2024-54230

Malicious code in bioql PyPI...

EUVD-2025-28580

Malicious code in bioql PyPI...

EUVD-2022-24880

Malicious code in bioql PyPI...

EUVD-2023-41951

Malicious code in bioql PyPI...

EUVD-2023-46582

Malicious code in bioql PyPI...

EUVD-2021-27731

Malicious code in bioql PyPI...

EUVD-2023-56332

Malicious code in bioql PyPI...

EUVD-2021-6986

Malicious code in bioql PyPI...

EUVD-2024-49608

Malicious code in bioql PyPI...

EUVD-2023-55042

Malicious code in bioql PyPI...

EUVD-2022-32813

Malicious code in bioql PyPI...